Systems and methods for reducing alert fatigue during operation of cyber-physical systems

Abstract

Disclosed herein are systems and methods for reducing or mitigation alert fatigue from real-time alerts in cyber-physical systems or other types of edge computing systems are provided. In one or more examples, the edge computing system monitor can look for one or more patterns within received data that can indicate malicious activity or other conditions that may warrant a real-time or near-real time response from the operator. In one or more examples, a detection of any of the specified patterns in the streaming data can trigger an alert to the operator of the edge computing system. In one or more examples, the alerts can be suppressed until the number of alerts associated with a particular pattern crosses a pre-determined threshold. Additionally or alternatively, alerts can be suppressed based on a duration that the alerts have been generated. The suppression of alerts can be configured to reduce operator alert fatigue.

What is claimed is: 
     
       1. A method for reducing a number of alerts provided to an edge computing system operator, the method comprising:
 receiving one or more messages transmitted between a plurality of components of the edge computing system; 
 receiving a list of information that comprises information about one or more components identified in the received one or more messages; 
 receiving one or more modifications to the received list of information from the edge computing system operator to generate a seen-list, wherein the seen-list comprises one or more components in the list of information that has been authorized by the edge computing system operator; 
 receiving one or more specifications of conditions to search for within the received one or more messages; 
 converting the one or more specifications of conditions into one or more watch points, wherein each watch point defines a pattern to be searched for in the one or more messages transmitted between the plurality of components; 
 determining the presence of one or more patterns within the received one or more messages based on the one or more watch points; and 
 if the one or more patterns within the received one or more messages are determined to be present:
 generating an alert; and 
 suppressing the alert from being transmitted to the edge computing system operator based on a comparison between the one or more patterns in the received one or more messages and the seen-list. 
 
 
     
     
       2. The method of  claim 1 , wherein the received list of information comprises one or more relationships between the one or more components of the edge computing system. 
     
     
       3. The method of  claim 1 , wherein the information about the one or more components identified in the received one or more messages comprises a plurality of MAC addresses, each MAC address associated with a component of the plurality of components of the edge computing system contained within the received list of information. 
     
     
       4. The method of  claim 1 , wherein the information about the one or more components identified in the received one or more messages comprises a plurality of IP addresses, each IP address associated with a component of the plurality of components of the edge computing system contained within the received list of information. 
     
     
       5. The method of  claim 1 , wherein the method comprises receiving a second list of information about the received one or more messages transmitted between a plurality of components of the edge computing system, wherein the second list of information is generated by comparing the received one or more messages to the seen-list. 
     
     
       6. The method of  claim 5 , wherein the method comprises receiving one or more modifications to the received second list of information from the edge computing system operator to generate one or more modifications to the seen-list. 
     
     
       7. The method of  claim 1 , wherein the received list of information is generated using one or more machine learning models that are applied to the received one or more messages. 
     
     
       8. A computing system for reducing an amount of alerts provided to an edge computing system operator, the system comprising:
 a display; 
 a user interface configured to receive inputs from a user of the system; 
 a memory; 
 one or more processors; and 
 one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs when executed by the one or more processors cause the processor to:
 receive one or more messages transmitted between a plurality of components of the edge computing system; 
 receive a list of information that comprises information about one or more components identified in the received one or more messages; 
 receive one or more modifications to the received list of information from the edge computing system operator to generate a seen-list, wherein the seen-list comprises one or more components in the list of information that has been authorized by the edge computing system operator; 
 receive one or more specifications of conditions to search for within the received one or more messages; 
 convert the one or more specifications of conditions into one or more watch points, wherein each watch point defines a pattern to be searched for in the one or more messages transmitted between the plurality of components; 
 determine the presence of one or more patterns within the received one or more messages based on the one or more watch points; and 
 if the one or more patterns within the received one or more messages are determined to be present:
 generate an alert; and 
 suppress the alert from being transmitted to the edge computing system operator based on a comparison between the one or more patterns in the received one or more messages and the seen-list. 
 
 
 
     
     
       9. The system of  claim 8 , wherein the received list of information comprises one or more relationships between the one or more components of the edge computing system. 
     
     
       10. The system of  claim 8 , wherein the information pertain about the one or more components identified in the received one or more messages comprises a plurality of MAC addresses, each MAC address associated with a component of the plurality of components of the edge computing system contained within the received list of information. 
     
     
       11. The system of  claim 10 , wherein the one or more processors are caused to receive one or more modifications to the received second list of information from the edge computing system operator to generate one or more modifications to the seen-list. 
     
     
       12. The system of  claim 8 , wherein the information about the one or more components identified in the received one or more messages comprises a plurality of IP addresses, each IP address associated with a component of the plurality of components of the edge computing system contained within the received list of information. 
     
     
       13. The system of  claim 8 , wherein the one or more processors are caused to receive a second list of information about the received one or more messages transmitted between a plurality of components of the edge computing system, wherein the second list of information is generated by comparing the received one or more messages to the seen-list. 
     
     
       14. The system of  claim 8 , wherein the received list of information is generated using one or more machine learning models that are applied to the received one or more messages. 
     
     
       15. A non-transitory computer readable storage medium storing one or more programs for reducing an amount of alerts provided to an edge computing system operator, the one or more programs comprising instructions, which, when executed by an electronic device with a display and a user input interface, cause the device to:
 receive one or more messages transmitted between a plurality of components of the edge computing system; 
 receive a list of information that comprises information about one or more components identified in the received one or more messages; 
 receive one or more modifications to the received list of information from the edge computing system operator to generate a seen-list, wherein the seen-list comprises one or more components in the list of information that has been authorized by the edge computing system operator; 
 receive one or more specifications of conditions to search for within the received one or more messages; 
 convert the one or more specifications of conditions into one or more watch points, wherein each watch point defines a pattern to be searched for in the one or more messages transmitted between the plurality of components; 
 determine the presence of one or more patterns within the received one or more messages based on the one or more watch points; and 
 if the one or more patterns within the received one or more messages are determined to be present:
 generate an alert; and 
 suppress the alert from being transmitted to the edge computing system operator based on a comparison between the one or more patterns in the received one or more messages and the seen-list. 
 
 
     
     
       16. The non-transitory computer readable storage medium of  claim 15 , wherein the received list of information comprises one or more relationships between the one or more components of the edge computing system. 
     
     
       17. The non-transitory computer readable storage medium of  claim 15 , wherein the information about the one or more components identified in the received one or more messages comprises a plurality of MAC addresses, each MAC address associated with a component of the plurality of components of the edge computing system contained within the received list of information. 
     
     
       18. The non-transitory computer readable storage medium of  claim 15 , wherein the information about the one or more components identified in the received one or more messages comprises a plurality of IP addresses, each IP address associated with a component of the plurality of components of the edge computing system contained within the received list of information. 
     
     
       19. The non-transitory computer readable storage medium of  claim 15 , wherein the one or more processors are caused to receive a second list of information about the received one or more messages transmitted between a plurality of components of the edge computing system, wherein the second list of information is generated by comparing the received one or more messages to the seen-list. 
     
     
       20. The non-transitory computer readable storage medium of  claim 19 , wherein the one or more processors are caused to receive one or more modifications to the received second list of information from the edge computing system operator to generate one or more modifications to the seen-list. 
     
     
       21. The non-transitory computer readable storage medium of  claim 15 , wherein the received list of information is generated using one or more machine learning models that are applied to the received one or more messages.